Re: [PATCH 1/1] bsg-lib: fix use-after-free under memory-pressure

2017-09-25 Thread Benjamin Block
On Mon, Sep 25, 2017 at 08:53:07AM -0700, Christoph Hellwig wrote: > > if (!q) > > return ERR_PTR(-ENOMEM); > > q->cmd_size = sizeof(struct bsg_job) + dd_job_size; > > - q->init_rq_fn = bsg_init_rq; > > - q->exit_rq_fn = bsg_exit_rq; > > + q->init_rq_fn = bsg_init_job; > >

Re: [PATCH 1/1] bsg-lib: fix use-after-free under memory-pressure

2017-09-25 Thread Christoph Hellwig
> if (!q) > return ERR_PTR(-ENOMEM); > q->cmd_size = sizeof(struct bsg_job) + dd_job_size; > - q->init_rq_fn = bsg_init_rq; > - q->exit_rq_fn = bsg_exit_rq; > + q->init_rq_fn = bsg_init_job; > + q->exit_rq_fn = bsg_exit_job; > + q->initialize_rq_fn = bs

[PATCH 1/1] bsg-lib: fix use-after-free under memory-pressure

2017-09-21 Thread Benjamin Block
When under memory-pressure it is possible that the mempool which backs the 'struct request_queue' will make use of up to BLKDEV_MIN_RQ count emergency buffers - in case it can't get a regular allocation. These buffers are preallocated and once they are also used, they are re-supplied with old finis